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Reports on Computer Systems Technology 


The Information Technology Laboratory (ITL) at the National Institute of Standards and 
Technology (NIST) promotes the U.S. economy and public welfare by providing technical 
leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test 
methods, reference data, proof of concept implementations, and technical analyses to advance the 
development and productive use of information technology. ITL’s responsibilities include the 
development of management, administrative, technical, and physical standards and guidelines for 
the cost-effective security and privacy of other than national security-related information in federal 
information systems. 


Abstract 

In recent years, there has been a substantial amount of research on quantum computers - 
machines that exploit quantum mechanical phenomena to solve mathematical problems that are 
difficult or intractable for conventional computers. If large-scale quantum computers are ever 
built, they will be able to break many of the public-key cryptosystems currently in use. This 
would seriously compromise the confidentiality and integrity of digital communications on the 
Internet and elsewhere. The goal of post-quantum cryptography (also called quantum-resistant 
cryptography) is to develop cryptographic systems that are secure against both quantum and 
classical computers, and can interoperate with existing communications protocols and networks. 
This Internal Report shares the National Institute of Standards and Technology (NIST)’s current 
understanding about the status of quantum computing and post-quantum cryptography, and 
outlines NIST’s initial plan to move forward in this space. The report also recognizes the 
challenge of moving to new cryptographic infrastructures and therefore emphasizes the need for 
agencies to focus on crypto agility. 
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1 Introduction 


In the last three decades, public key cryptography has become an indispensable component of 
our global communication digital infrastructure. These networks support a plethora of 
applications that are important to our economy, our security, and our way of life, such as mobile 
phones, internet commerce, social networks, and cloud computing. In such a connected world, 
the ability of individuals, businesses and governments to communicate securely is of the utmost 
importance. 

Many of our most crucial communication protocols rely principally on three core cryptographic 
functionalities: public key encryption, digital signatures, and key exchange 1 . Currently, these 
functionalities are primarily implemented using Diffie-Hellman key exchange, the RSA (Rivest- 
Shamir-Adleman) cryptosystem, and elliptic curve cryptosystems. The security of these depends 
on the difficulty of certain number theoretic problems such as Integer Factorization or the 
Discrete Log Problem over various groups. 

In 1994, Peter Shor of Bell Laboratories showed that quantum computers, a new technology 
leveraging the physical properties of matter and energy to perform calculations, can efficiently 
solve each of these problems, thereby rendering all public key cryptosystems based on such 
assumptions impotent [JJ. Thus a sufficiently powerful quantum computer will put many forms 
of modem communication—from key exchange to encryption to digital authentication—in peril. 

The discovery that quantum computers could be utilized to solve certain problems faster than 
classical computers has inspired great interest in quantum computing. Is quantum complexity 
fundamentally different from classical complexity? When will large-scale quantum computers be 
built? Is there a way to resist both a quantum and a classical computing adversary? Researchers 
are working on these questions. 

In the twenty years since Shor’s discovery, the theory of quantum algorithms has developed 
significantly. Quantum algorithms achieving exponential speedup have been discovered for 
several problems relating to physics simulation, number theory, and topology. Nevertheless, the 
list of problems admitting exponential speedup by quantum computation remains relatively 
small. In contrast, more modest speedups have been developed for broad classes of problems 
related to searching, collision finding, and evaluation of Boolean formulae. In particular, 
Grover’s search algorithm proffers a quadratic speedup on unstructured search problems. While 
such a speedup does not render cryptographic technologies obsolete, it can have the effect of 
requiring larger key sizes, even in the symmetric key case. See Table 1 for a summary of the 
impact of large-scale quantum computers on common cryptographic algorithms, such as RSA 
and the Advanced Encryption Standard (AES). It is not known how far these quantum 
advantages can be pushed, nor how wide is the gap between feasibility in the classical and 
quantum models. 


1 NIST standardized digital signature schemes in r FIPS 186-41 . as well as public key-based key establishment schemes in 
r SP800-56Al (using key exchange) and 1 SP800-56B 1 (using public key encryption). 
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The question of when a large-scale quantum computer will be built is complicated and 
contentious. While in the past it was less clear that large quantum computers are a physical 
possibility, many scientists now believe it to be merely a significant engineering challenge. Some 
experts even predict that within the next 20 or so years, sufficiently large quantum computers 
will be built to break essentially all public key schemes currently in use [2], It has taken almost 
20 years to deploy our modern public key cryptography infrastructure. It will take significant 
effort to ensure a smooth and secure migration from the current widely used cryptosystems to 
their quantum computing resistant counterparts. Therefore, regardless of whether we can 
estimate the exact time of the arrival of the quantum computing era, we must begin now to 
prepare our information security systems to be able to resist quantum computing. 

Table 1 - Impact of Quantum Computing on Common Cryptographic Algorithms 


Cryptographic Algorithm 

Type 

Purpose 

Impact from large-scale 
quantum computer 

AES 

Symmetric key 

Encryption 

Larger key sizes needed 

SHA-2, SHA-3 


Hash functions 

Larger output needed 

RSA 

Public key 

Signatures, key 
establishment 

No longer secure 

ECDSA, ECDH 
(Elliptic Curve 

Cryptography) 

Public key 

Signatures, key 
exchange 

No longer secure 

DSA 

(Finite Field Cryptography) 

Public key 

Signatures, key 
exchange 

No longer secure 


A large international community has emerged to address the issue of infonnation security in a 
quantum computing future, in the hope that our public key infrastructure may remain intact by 
utilizing new quantum-resistant primitives. In the academic world, this new science bears the 
name “Post-Quantum Cryptography 2 .” This is an active area of research, with its own conference 
series, PQCrypto, which started in 2006. It has received substantial support from national 
funding agencies, most notably in Europe and Japan, through the European Union (EU) projects 
PQCrypto and SAFEcrypto, and the CREST Crypto-Math project in Japan. 

These efforts have led to advances in fundamental research, paving the way for the deployment 
of post-quantum cryptosystems in the real world. In the past few years, industry and standards 


2 Post-quantum cryptography should not be conflated with quantum cryptography (or quantum key-distribution), which uses 
properties of quantum mechanics to create a secure communication channel. This report is only concerned with post-quantum 
cryptography. 
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organizations have started their own activities in this field: since 2013, the European 
Telecommunications Standards Institute (ETSI) has held three “Quantum-Safe Cryptography" 
workshops, and in 2015 NIST held a workshop on “Cybersecurity in a Post-Quantum World,” 
which was attended by over 140 people from government, industry, and academia. 

NIST has a unique role to play in standardizing post-quantum cryptography, as part of its broader 
responsibility for the development of standards and guidelines for the protection of non-national- 
security federal information systems. Many NIST standards, such as the Advanced Encryption 
Standard (AES), have been developed with broad participation from academia and industry, and 
have been widely adopted because they are effective solutions, thus helping to protect U.S. 
information and information systems. NIST standardization of post-quantum cryptography will 
likely provide similar benefits. 

Considering all of these sources, it is clear that the effort to develop quantum-resistant 
technologies is intensifying. Equally clear is the urgency, implied by these investments, of the 
need for standardizing new post-quantum public key cryptography. It is critical to engage with 
the community for NIST cryptographic standards to be endorsed by industry and other standards 
organizations around the world. This Internal Report shares NIST’s current understanding about 
the status of quantum computing and post-quantum cryptography, and outlines our initial plan to 
move forward. 


2 An Overview of Quantum-Resistant Cryptography 


The most important uses of public key cryptography today are for digital signatures and key 
establishment. As mentioned in Section 1 , the construction of a large-scale quantum computer 
would render many of these public key cryptosystems insecure. In particular, this includes those 
based on the difficulty of integer factorization, such as RSA, as well as ones based on the 
hardness of the discrete log problem. In contrast, the impact on symmetric key systems will not 
be as drastic (see Table 1) . Grover’s algorithm provides a quadratic speed-up for quantum 
search algorithms in comparison with search algorithms on classical computers. We don’t kn ow 
that Grover’s algorithm will ever be practically relevant, but if it is, doubling the key size will be 
sufficient to preserve security. Furthermore, it has been shown that an exponential speed up for 
search algorithms is impossible, suggesting that symmetric algorithms and hash functions should 
be usable in a quantum era [3], 

Consequently, the search for algorithms believed to be resistant to attacks from both classical 
and quantum computers has focused on public key algorithms. In this section, we briefly give an 
overview of the main families for which post-quantum primitives have been proposed. These 
families include those based on lattices, codes, and multivariate polynomials, as well as a 
handful of others. For further information, see [4, 5]. 

Lattice-based cryptography - Cryptosystems based on lattice problems have received renewed 
interest, for a few reasons. Exciting new applications (such as fully homomorphic encryption, 
code obfuscation, and attribute-based encryption) have been made possible using lattice-based 
cryptography. Most lattice-based key establishment algorithms are relatively simple, efficient, 
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and highly parallelizable. Also, the security of some lattice-based systems are provably secure 
under a worst-case hardness assumption, rather than on the average case. On the other hand, it 
has proven difficult to give precise estimates of the security of lattice schemes against even 
known cryptanalysis techniques. 

Code-based cryptography - In 1978, the McEliece cryptosystem was first proposed, and has 
not been broken since. Since that time, other systems based on error-correcting codes have been 
proposed. While quite fast, most code-based primitives suffer from having very large key sizes. 
Newer variants have introduced more structure into the codes in an attempt to reduce the key 
sizes, however the added structure has also led to successful attacks on some proposals. While 
there have been some proposals for code-based signatures, code-based cryptography has seen 
more success with encryption schemes. 

Multivariate polynomial cryptography - These schemes are based on the difficulty of solving 
systems of multivariate polynomials over finite fields. Several multivariate cryptosystems have 
been proposed over the past few decades, with many having been broken [6]. While there have 
been some proposals for multivariate encryption schemes, multivariate cryptography has 
historically been more successful as an approach to signatures. 

Hash-based signatures - Hash-based signatures are digital signatures constructed using hash 
functions. Their security, even against quantum attacks, is well understood. Many of the more 
efficient hash-based signature schemes have the drawback that the signer must keep a record of 
the exact number of previously signed messages, and any error in this record will result in 
insecurity. Another drawback is that they can produce only a limited number of signatures. The 
number of signatures can be increased, even to the point of being effectively unlimited, but this 
also increases the signature size. 

Other - A variety of systems have been proposed which do not fall into the above families. One 
such proposal is based on evaluating isogenies on supersingular elliptic curves. While the 
discrete log problem on elliptic curves can be efficiently solved by Shor’s algorithm on a 
quantum computer, the isogeny problem on supersingular curves has no similar quantum attack 
known. Like some other proposals, for example those based on the conjugacy search problem 
and related problems in braid groups, there has not been enough analysis to have much 
confidence in their security. 


It seems improbable that any of the currently known algorithms can serve as a drop-in 
replacement for what is in use today. One challenge that will likely need to be overcome is that 
most of the quantum-resistant algorithms have larger key sizes than the algorithms they will 
replace. This may result in needing to change various Internet protocols, such as the Transport 
Layer Security (TLS) protocol, or the Internet Key Exchange (IKE). The ways in which this 
should be done must be carefully considered. 

We note that none of the above proposals have been shown to guarantee security against all 
quantum attacks. A new quantum algorithm may be discovered which breaks some of these 
schemes. However, this is similar to the state today. Although most public key cryptosystems 
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come with a security proof, these proofs are based on unproven assumptions. Thus the lack of 
known attacks is used to justify the security of public key cryptography currently in use. 
Nonetheless, NIST believes that more research and analysis are needed before any of the above 
proposed post-quantum algorithms could be recommended for use today. They have not received 
nearly as much scrutiny from the cryptographic community as the currently deployed algorithms. 
One exception is hash-based signatures, whose security is well-understood. For certain specific 
applications, such as digital code signing, hash-based signatures could potentially be 
standardized in the next few years. 


3 Progress in Quantum Computing Hardware 


Research into the feasibility of building large-scale quantum computers began in earnest after 
Peter Shor’s 1994 discovery of a polynomial-time quantum algorithm for integer factorization 
m . At the time, it was unclear whether quantum computing would ever be a fundamentally 
scalable technology. Many leading experts suggested that quantum states were too fragile and 
subject to the accumulation of error for large-scale quantum computation ever to be realized. 

This situation changed in the late 1990s with the development of quantum error correcting codes 
and threshold theorems [7]. These threshold theorems show that if the error rate per logical 
operation (“quantum gate”) in a quantum computer can be brought below a fixed threshold then 
arbitrarily long quantum computations can be carried out in a reliable and fault-tolerant manner 
by incorporating error-correction steps throughout the execution of the quantum computation [8]. 

Over the years, experimentalists have gradually developed improved hardware with ever lower 
error rates per quantum gate. Simultaneously, theorists have developed new quantum error 
correction procedures yielding higher fault-tolerance thresholds. Recently, some experiments 
using ion traps and superconducting circuits have demonstrated universal sets of quantum gates 
that are nominally below the highest theoretical fault-tolerance thresholds (around 1 %) [9, 101 . 
This is a significant milestone, which has spurred increased investment from both government 
and industry. However, it is clear that substantial long-term efforts are needed to move from 
present-day laboratory demonstrations involving a few qubits up to large-scale quantum 
computers involving thousands of logical qubits encoded in perhaps hundreds of thousands or 
millions of physical qubits. 

In parallel to the development of general-purpose digital quantum computers, there have been 
efforts to develop special purpose analog quantum computers, such as quantum annealers (e.g. 
the D-Wave machine), analog quantum simulators, and boson sampling devices. Some of these 
devices have been scaled up to far larger numbers of qubits than digital quantum computers 
have. However, due to their specialized nature, these analog quantum devices are not believed to 
be of relevance to cryptanalysis. 
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4 The Path Forward 


The need for stronger cryptography is driven by advances in both classical and quantum 
computing technologies. To maintain security against classical attacks, NIST has already 
recommended transitions from key sizes and algorithms that provide 80 bits of security, to key 
sizes and algorithms that provide 112 or 128 bits of security [SP 800-131A1 . To provide security 
against quantum attacks, NIST will have to facilitate a more difficult transition, to new post¬ 
quantum cryptosystems. 

It is unclear when scalable quantum computers will be available. However, in the past year or so, 
researchers working on building a quantum computer have estimated that it is likely that a 
quantum computer capable of breaking 2000-bit RSA in a matter of hours could be built by 2030 
for a budget of about a billion dollars [111 . This is a serious long-term threat to the 
cryptosystems currently standardized by NIST. 

It is useful to compare the above predictions with the cost of breaking these cryptosystems using 
classical computers. Cryptosystems offering 80 bits of security or less, which were phased out in 
2011-2013, are at the greatest risk: they can be broken now at a cost ranging from tens of 
thousands to hundreds of millions of dollars [12, 13, 14, 151 . Cryptosystems offering 112 bits of 
security are likely to remain secure for some time: they may be breakable for a budget of a 
billion dollars in 30 to 40 years 3 (using classical computers). 

Thus, transitioning from 112 to 128 (or higher) bits of security is perhaps less urgent than 
transitioning from existing cryptosystems to post-quantum cryptosystems. This post-quantum 
transition raises many fundamental challenges. 

Previous transitions from weaker to stronger cryptography have been based on the bits-of- 
security paradigm, which measures the security of an algorithm based on the time-complexity of 
attacking it with a classical computer (e.g. an algorithm is said to have 128 bits of security if the 
difficulty of attacking it with a classical computer is comparable to the time and resources 
required to brute-force search for a 128-bit cryptographic key.) NIST Special Publication (SP) 
800-57 Part 1 [SP800-571 classifies the algorithms standardized by NIST as of January 2016 into 
80, 112, 128, 192 and 256 bits of security. It further recommended that the 80-bit security level 
is no longer considered sufficiently secure, and the 112-bit security level be phased out by 2031. 

Unfortunately, the bits-of-security paradigm does not take into account the security of algorithms 
against quantum cryptanalysis, so it is inadequate to guide our transition to quantum-resistant 
cryptography. There is not yet a consensus view on what key lengths will provide acceptable 
levels of security against quantum attacks. For symmetric key systems, one simple heuristic is to 
double the key lengths to compensate for the quadratic speedup achieved by Grover’s algorithm. 
But this recommendation may be overly conservative, as quantum computing hardware will 
likely be more expensive to build than classical hardware. At the same time, this 
recommendation does not take into account the possibility of more sophisticated quantum attacks 


3 This is based on an extrapolation assuming Moore’s law, assuming roughly 90 bits of security is breakable now for one billion 
dollars and 18 months per bit of security at a given cost. 
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[16, 17, 181 . Our understanding of quantum cryptanalysis remains rather limited, and more 
research in this area is urgently needed. 

The development of standards for post-quantum cryptography will require significant resources 
to analyze candidate quantum-resistant schemes, and will require significant public engagement 
to assure trust in the algorithms NIST chooses to standardize. Interest in the areas of quantum 
computing and quantum-resistant cryptography has recently increased, due to milestones in the 
development of quantum computing hardware and the National Security Agency’s (NSA) recent 
changes to its Suite B guidance [19]. This provides an opportunity for engagement with the 
research community that may not come again before practical quantum computing is truly 
imminent. Consequently, NIST is beginning to prepare for the transition to quantum-resistant 
cryptography now. 

NIST is taking the following steps to initiate a standardization effort in post-quantum 
cryptography. NIST plans to specify preliminary evaluation criteria for quantum-resistant public 
key cryptography standards. The criteria will include security and performance requirements. 

The draft criteria will be released for public comments in 2016 and hopefully finalized by the 
end of the year. At that time NIST will begin accepting proposals for quantum-resistant public 
key encryption, digital signature, and key exchange algorithms. NIST intends to select at least 
one algorithm providing each of these functionalities for standardization. NIST will establish a 
submission deadline late in 2017 for algorithms to be considered, allowing the proposals to be 
subject to 3 to 5 years of public scrutiny before they are standardized. 

While this process will have many commonalities with the processes that led to the 
standardization of AES [20] and SHA3 [211 , this is not a competition. NIST sees its role as 
managing a process of achieving community consensus in a transparent and timely manner. 
Ideally, several algorithms will emerge as “good choices.” NIST may pick one or more of these 
for standardization in each category. In this respect, NIST’s process for standardizing quantum- 
resistant public key cryptography will be similar to the ongoing block cipher modes development 
process [221 . 

When standards for quantum-resistant public key cryptography become available, NIST will 
reassess the imminence of the threat of quantum computers to existing standards, and may decide 
to deprecate or withdraw the affected standards thereafter as a result. Agencies should therefore 
be prepared to transition away from these algorithms as early as 10 years from now. As the 
replacements for currently standardized public key algorithms are not yet ready, a focus on 
maintaining crypto agility is imperative. Until new quantum-resistant algorithms are 
standardized, agencies should continue to use the recommended algorithms currently specified in 
NIST standards. 
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